Drift subsystem cleanup: prune inert code, pin excludeFamilies, mirror-equivalence guard, trim workflow perms

[jpr5]

Drift subsystem cleanup

Fast-follow to the deterministic self-healing drift re-architecture (#335). Four low-risk cleanups the CR flagged as follow-ups; no behavior change to the shipped remediation flow.

What changed

• Prune inert code — the workflow now builds its PR body inline and commits via commitSyncChanges, which left buildPrBody, gatedCommitFiles, isProductionFile (and their orphaned helpers truncateBody/GH_BODY_MAX/GH_BODY_SAFE_MAX/affectedSkillSections/BUILDER_TO_SKILL_SECTION) with no production caller. Removed them and their tests.
• Stop re-proposing claude-fable-5 — the registry intentionally carries a forward-looking family that isn't live yet, so the sync proposed removing it every run. Added a small isForwardLookingFamily allowlist applied at the sync-policy layer (detectDeprecatedFamiliesForSync); the canonical detector is unchanged, so genuine retirements are still detected.
• Pin excludeFamilies/includeFamilies data — logic-pin.test.ts previously froze only the classification rules, not the membership data; a family could have been silenced by adding it straight to excludeFamilies. Added a DATA_FROZEN checksum block (hashes the live sets) that fails loudly on any membership change.
• Sync-mirror equivalence guard — added a test that verifies the sync core's mirrored predicates stay faithful to the canonical detectDeprecatedFamilies for normal families, and explicitly asserts the one intended forward-looking divergence (so removing the filter above fails the test).
• Trim dead workflow permissions — removed checks: read / statuses: read (and their app-token counterparts + a stale comment) from fix-drift.yml; nothing in the workflow consumes check-runs or statuses, and it does no auto-merge.

Review

Tier-1 CR (correctness + test-guard quality), 2 reviewers, 0 mandatory findings — both empirically verified the new pins/guards are non-vacuous (recomputed all 6 data-pin hashes; confirmed the mirror-divergence test fails if the forward-looking filter is removed).

Test evidence

tsc --noEmit 0 errors · full suite green · logic-pin 20 · drift-sync-mirror-equivalence 28.

Deferred follow-ups (not in this PR)

• Bedrock $metadata: the 2 forced-credential failures in the bedrock drift leg are a category error in the drift test's own SDK-shape stubs — they compare the SDK client-output shape (which includes $metadata) against the raw wire body. $metadata is synthesized by the AWS SDK from HTTP status/headers after deserialization; it is not part of the Bedrock wire response. The correct fix is to the test stubs (dormant — needs a live Bedrock recording), not the mock.
• The mirror-equivalence test imports models.drift.ts, so a local pnpm test run with provider API keys exported would also execute the live-availability suites (harmless in CI, which sets no keys). De-coupling would require extracting the canonical predicates into a non-.drift.ts module — deferred.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KamK73Wu5heLxJEogM6hHC

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@copilotkit/aimock@336

commit: 4ae0348